darman/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: condense comments across the repo

Browse Source 
Comments had drifted into multi-paragraph narrative (git commit
lineage, debugging stories, restated code) in several hot spots
(scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix).
Trim every comment to its load-bearing "why" — gotchas, safety
warnings, and non-obvious rationale survive verbatim in substance,
just tightened to 1-2 sentences; historical narrative and anything
already covered in CLAUDE.md is cut. No code/logic changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
This commit is contained in:
darman
2026-09-18 21:36:30 +02:00
co-authored by Claude Sonnet 5
parent 3899290c5b
commit 6f24ab69ad
47 changed files with 1051 additions and 1965 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/neptun/secrets.nix
+11 -18
View File
@@ -14,13 +14,11 @@
sops.secrets.darman_password.neededForUsers = true;
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
# Authentik takes a single systemd EnvironmentFile (services/identity/authentik.nix).
# No `owner` here on purpose: systemd reads EnvironmentFile as root before
# dropping to the service's DynamicUser, so root:root 0400 is what we want.
#
# AUTHENTIK_SECRET_KEY signs sessions/tokens — rotating it logs everyone out.
# The BOOTSTRAP_* vars only take effect on the very first start, where they
# create the `akadmin` superuser; they're inert on every boot after that.
# Authentik takes a single systemd EnvironmentFile (services/identity/authentik.nix);
# no `owner` here on purpose, since systemd reads it as root before dropping to
# DynamicUser. AUTHENTIK_SECRET_KEY signs sessions (rotating it logs everyone out);
# the BOOTSTRAP_* vars only matter on the very first start (create `akadmin`) and are
# inert after.
sops.secrets.authentik_secret_key = { };
sops.secrets.authentik_bootstrap_password = { };
sops.secrets.authentik_bootstrap_email = { };
@@ -38,17 +36,12 @@
ACME_EMAIL=${config.sops.placeholder.caddy_acme_email}
'';
# Headplane: cookie_secret_path takes a path natively (no store leak).
# oidc.client_secret + the headscale API key are still REPLACE_ME
# placeholders (see services/vpn/headplane.nix) until Authentik/headscale are
# actually deployed and those get created for real.
#
# owner: unlike authentik's EnvironmentFile above, headscale and headplane
# open these paths themselves, already running as the headscale user — so
# the root:root 0400 default would fail and each needs an explicit owner.
#
# headscale's OIDC client is a SEPARATE Authentik application from
# headplane's (services/vpn/headscale.nix), hence the second client secret.
# Headplane's cookie_secret_path takes a path natively (no store leak); oidc.client_secret
# and the headscale API key are still REPLACE_ME placeholders (services/vpn/headplane.nix)
# until Authentik/headscale are deployed for real. Unlike authentik's EnvironmentFile,
# headscale/headplane open these paths themselves as the headscale user, so each needs
# an explicit owner — and headscale's OIDC client is a separate Authentik app from
# headplane's, hence the second client secret.
sops.secrets.headscale_oidc_client_secret.owner = "headscale";
sops.secrets.headplane_cookie_secret.owner = "headscale";